Data Breaches in 2026: How the Year's Major Incidents Actually Happened

Most major data breaches of 2026 did not start with a novel exploit. Hims & Hers, MSG Sports and Charter were reached through social engineering, in the first two cases into single sign-on and in Charter's into a connected SaaS platform. The extortion group claims the same of Exact Sciences, which Abbott has not confirmed. EY and MIP Holdings lost data held in support platforms. The FBI and Poppins Payroll were exposed through contractor or vendor systems.

How to read a year of breach headlines

This is not a ranked list. Ranking by record count rewards whoever posted the biggest number, and in 2026 many of the biggest numbers were attacker claims or compilations of older data. SpyCloud's September 2026 review made the same point: a headline count says little about risk until you know who produced it and whether passwords are included. It also estimated that about 70% of records exposed this year carried no passwords, which shifts the risk toward fraud and social engineering rather than straight account takeover.

What follows groups the year's publicly reported incidents by how access was gained, using the reporting cited in each case. Where a figure or attribution is a claim, it is labelled as one.

Pattern 1: a phone call, then single sign-on, then every connected app

The most repeated story of 2026 starts with a human being talked into something.

  • Hims & Hers said attackers socially engineered two employees in February, compromised an Okta single sign-on account, and used it to reach its Zendesk support platform.
  • Exact Sciences, now part of Abbott, was hit through voice phishing that compromised a Microsoft Entra SSO account, with data taken from connected SaaS platforms, per BleepingComputer.
  • MSG Sports was reached through a phishing call to a low-level employee that gave access to Microsoft Entra, according to SpyCloud's tracker.
  • Charter Communications (Spectrum) saw a phishing call lead to Salesforce access in April, per SpyCloud. Volume figures ranged from 4.9 million to a claimed 42 million.
  • iRhythm and DriveWealth each reported social engineering as the entry point. ASOS described compromised employee credentials used against third-party platforms.

SpyCloud ties one group, ShinyHunters, to at least four of the year's largest incidents, including Exact Sciences, DentaQuest, MSG Sports, and Canvas maker Instructure.

The mechanism is the same each time. SSO concentrates access by design, so one session reaches every connected SaaS tenant, and those tenants hold bulk export features built for administrators. The weak step is usually a reset or enrolment flow handled by a person on the phone. Push and SMS MFA do not stop an attacker who has convinced the help desk to enrol a new device.

Pattern 2: the support platform is the data store

Support tools were the target in several incidents, not a stepping stone.

  • EY: BleepingComputer reported that an attacker breached a third-party support ticket platform used by EY IT staff between March 28 and April 12, 2026, and downloaded ticket attachments holding client tax data.
  • MIP Holdings: the company's own breach notice says a ransomware group calling itself The Gentlemen hit a Jira tool, and that credentials taken from it were used to reach file transfer servers.
  • Hims & Hers: the prize was Zendesk tickets containing names, emails, phone numbers, and addresses.

Tickets accumulate whatever users and agents paste into them: screenshots, forwarded emails, exports, documents. None of it passes through the classification and encryption controls applied to production databases, and retention is rarely set. A support platform with five years of attachments is a data warehouse that nobody registered as one.

Pattern 3: vendors, contractors, and infrastructure nobody owns

The third cluster is access you granted and then stopped watching.

  • FBI: the bureau said a contractor failed to apply a patch to a third-party platform, and removed that contractor. Reuters' anonymous sources, not the FBI, identified the platform as Oracle PeopleSoft and the contractor as Accenture.
  • Poppins Payroll: an unauthorised party exploited a vulnerability in Metabase software operated by a vendor.
  • Double Counter: a Metabase instance left public on a retired server yielded cloud credentials and a bot token.
  • Japan: JR East and JR Kyushu were affected by ransomware at IDC Frontier, a SoftBank cloud subsidiary, per Japan Times and Jiji Press.
  • DriveWealth: data on Revolut customers was exposed at the brokerage, covering a historical arrangement that Revolut moved its UK, EEA and Australian customers off between 2023 and 2025.
  • Klue: SpyCloud reports compromised integrations were used to exfiltrate data from customers' Salesforce environments, claimed by the Icarus group.

The common failure is ownership. Patch obligations sat with a contractor nobody verified. A dashboard outlived the server it was built for. A vendor relationship ended but the data stayed.

Pattern 4: lawful access, abused

In Denmark, attackers abused a small company's legitimate access to the Central Person Register and ran automated lookups returning about 8.8 million records, a count that includes deceased and emigrated people rather than 8.8 million living individuals. The attacker told Politiken that accounts used the password 123456, a claim authorities have not confirmed. The access was authorised; the volume was not. Detection came from an unusually large bill. Any system that sells or grants lookup access needs per-client volume baselines, because a valid credential doing a million queries looks valid on every check except the count.

Pattern 5: someone else finds it first

Several organisations learned of their incident from outside. State Bank of India was alerted on October 16 by its threat intelligence provider, CERT-In, and the Defence Cyber Agency, and disclosed on October 21 that a preliminary review found personal data in 3,897 customer records among roughly 375,000 records described as available on the dark web. SBI has not confirmed the dataset's authenticity. Military Times reported a Defense Manpower Data Center file-sharing flaw that exposed personnel files from October 2025 until discovery on July 16, 2026. Extortion groups increasingly announce first and let the victim catch up.

That changes the shape of the first day. The process has to start from an unverified external claim, sample the data, and decide what to tell customers before the root cause is known.

What to change before 2027

Roughly in order of how often each gap appears in the incidents above:

  1. Phishing-resistant MFA and hardened reset flows for anyone with SSO admin, support platform, or CRM export rights. Verify identity for help-desk resets out of band.
  2. Alerting on bulk exports from SaaS tenants: Salesforce, Zendesk, Jira, and similar. Export volume is a cheap, high-signal detection.
  3. Retention and redaction on support platforms, including attachments.
  4. A vendor data inventory that lists what each supplier holds, who patches it, and how you verify, and that survives contract termination.
  5. Decommission checklists that include analytics tools, dashboards, and integration tokens.
  6. A playbook for external tips and extortion claims, with an owner and a clock that starts at the tip.

Frequently asked questions

What were the biggest data breaches of 2026?
By people notified, DentaQuest stands out, with HIPAA Journal reporting more than 15 million affected. Large incidents also hit Exact Sciences, MSG Sports, Charter, and Instructure, though many of the biggest figures are attacker claims. SpyCloud's tracker also lists compilations and scraped datasets with hundreds of millions of rows, which are not single breaches.
How did most 2026 data breaches start?
Mostly through people and trusted access rather than novel exploits. Social engineering of employees, often by phone, led to single sign-on accounts and then connected SaaS platforms at Hims & Hers, Exact Sciences, MSG Sports, and Charter, per public reporting. Vendor systems, unpatched contractor platforms, and forgotten infrastructure accounted for many of the rest.
Why are support platforms showing up in so many breaches?
Support tickets collect attachments, screenshots, and pasted data that never pass through production data controls, and retention is rarely enforced. EY lost client tax documents attached to tickets, MIP Holdings had unencrypted customer data in Jira tickets, and Hims & Hers lost Zendesk ticket contents. Support tools are effectively unregistered data stores.
Are breach record counts reliable?
Treat them with care. Many headline counts come from extortion groups advertising data, and some datasets are compilations of older breaches. Confirmed counts usually come later from regulatory filings or notification letters. SpyCloud noted about 70% of 2026 exposed records carried no passwords, so the type of data matters more than the raw number.